Breaches and incidentsBriefChecked against a primary source
European Commission Europa hosting breach via the Trivy supply-chain compromise
CERT-EU: on 19 Mar an attacker used an AWS API key exposed through the compromised Trivy release, created a new access key on an existing user, ran...
- Disclosed
What happened
- CERT-EU: on 19 Mar an attacker used an AWS API key exposed through the compromised Trivy release, created a new access key on an existing user, ran TruffleHog and exfiltrated about 91.7 GB compressed (340 GB uncompressed). Alerts fired 24 Mar. Up to 71 Europa hosting clients affected (42 Commission, 29+ other EU bodies): names, usernames, emails and 51,992 outbound email files. ShinyHunters published the data on 28 Mar.
- Attribution: CERT-EU links the access vector to the Trivy compromise attributed to TeamPCP by Aqua; ShinyHunters published but is not named as the intruder.
Sources
- https://cert.europa.eu/blog/european-commission-cloud-breach-trivy-supply-chain
- https://securityaffairs.com/190333/cyber-crime/qilin-ransomware-die-linke-attack.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.